Merge "Move crypt commands to a different listener in vold" into mnc-dev
diff --git a/domain.te b/domain.te
index fc4cfd8..19de0c0 100644
--- a/domain.te
+++ b/domain.te
@@ -350,6 +350,10 @@
-zygote
-installd
-dex2oat
+ -system_server # TODO: The system server needs to create directories
+ # and link files for split APK installs. This could perhaps be
+ # removed if we made installd responsible for manipulating the
+ # staging directory.
} dalvikcache_data_file:file no_w_file_perms;
# Only system_server should be able to send commands via the zygote socket
diff --git a/file.te b/file.te
index 3ecb143..555b89f 100644
--- a/file.te
+++ b/file.te
@@ -171,6 +171,7 @@
type logdw_socket, file_type, mlstrustedobject;
type mdns_socket, file_type;
type mdnsd_socket, file_type, mlstrustedobject;
+type misc_logd_file, file_type;
type mtpd_socket, file_type;
type netd_socket, file_type;
type property_socket, file_type;
diff --git a/file_contexts b/file_contexts
index ce75629..406f6a8 100644
--- a/file_contexts
+++ b/file_contexts
@@ -240,6 +240,7 @@
/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
+/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
/data/misc/media(/.*)? u:object_r:media_data_file:s0
/data/misc/net(/.*)? u:object_r:net_data_file:s0
/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
diff --git a/init.te b/init.te
index 3af01fb..34b010c 100644
--- a/init.te
+++ b/init.te
@@ -161,6 +161,10 @@
domain_trans(init, shell_exec, shell)
domain_trans(init, init_exec, ueventd)
domain_trans(init, init_exec, watchdogd)
+# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
+userdebug_or_eng(`
+ domain_auto_trans(init, logcat_exec, logd)
+')
# Support "adb shell stop"
allow init self:capability kill;
diff --git a/logd.te b/logd.te
index 8c28b48..b0d978f 100644
--- a/logd.te
+++ b/logd.te
@@ -10,6 +10,10 @@
allow logd kernel:system syslog_read;
allow logd kmsg_device:chr_file w_file_perms;
allow logd system_data_file:file r_file_perms;
+allow logd misc_logd_file:file create_file_perms;
+allow logd misc_logd_file:dir rw_dir_perms;
+allow logd pstorefs:dir search;
+allow logd pstorefs:file r_file_perms;
r_dir_file(logd, domain)
@@ -17,6 +21,11 @@
control_logd(logd)
+# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
+userdebug_or_eng(`
+ unix_socket_connect(logd, logdr, logd)
+')
+
###
### Neverallow rules
###
diff --git a/shell.te b/shell.te
index c55ce3e..ac55346 100644
--- a/shell.te
+++ b/shell.te
@@ -15,6 +15,9 @@
# logcat -L (directly, or via dumpstate)
allow shell pstorefs:dir search;
allow shell pstorefs:file r_file_perms;
+# logpersistd (nee logcatd) files
+allow shell misc_logd_file:dir r_dir_perms;
+allow shell misc_logd_file:file r_file_perms;
# read files in /data/anr
allow shell anr_data_file:dir r_dir_perms;
diff --git a/system_server.te b/system_server.te
index 0b18eb4..5d1398a 100644
--- a/system_server.te
+++ b/system_server.te
@@ -16,6 +16,25 @@
allow system_server dalvikcache_data_file:file execute;
allow system_server dalvikcache_data_file:dir r_dir_perms;
+# For PackageInstallerSession.
+#
+# All of these rules relate to the installation and compilation of split
+# APKs. Roughly, the process is as follows. The rules below only pertain
+# to step (3) of the process
+#
+# (1) Create a staging directory.
+# (2) Link existing APKs from the split
+#
+# (3) Link existing compiled oat files : This requires "create_dir_perms"
+# to create oat directories (foo/oat and foo/oat/x86), "relabelto" to
+# make sure they have the right label, and "link" to link files.
+#
+# (3) Invoke dex2oat to compile the updated / new split
+# (4) Rename the staging directory back to the final path.
+allow system_server dalvikcache_data_file:file link;
+allow system_server dalvikcache_data_file:dir relabelto;
+allow system_server dalvikcache_data_file:dir create_dir_perms;
+
# /data/resource-cache
allow system_server resourcecache_data_file:file r_file_perms;
allow system_server resourcecache_data_file:dir r_dir_perms;